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CHICAGO (АР) _ Investigators were led to a teen-age computer 
buff who tapped into NATO and Air Force base telephone networks 
after he sent messages using the code name "Shadow Hawk" that 
bragged of his actions. 

In a Secret Service raid on the Chicago home of the 17-year-old 
hacker, agents confiscated his three computers and software stolen 
through AT&T company systems, said William J. Cook, an assistant 
U.S. attorney. 

AT&T put the value of the software, some of which is not yet on 
the market, at more than $1 million. 

Federal investigators now are analyzing piles of computer 
printouts to assess the damage before they decide whether to charge 
the youth. 

There was no physical break-in, Cook said Thursday. The computer 


programs and other information were obtained by tapping into the 


Systems by telephone, using another computer. 

Shadow Hawk penetrated AT&T computers by disguising his own 
computer as a telephone company computer, then transferring company 
files into it, Cook explained. 

Agents have been working full time since the Sept. 4 raid 
printing out "the enormous quantity of material stored in his 
computers," Cook said. 

National security was not seriously jeopardized by the theft of 
material from an AT&T computer at NATO Maintenance and Supply 
Headquarters in Burlington, N.C., Cook said. 

However, he declined to comment on the nature of information 
taken from àn Air Force Base in Georgia. 

The teen-ager also is suspected of revealing AT&T security 
devices over a computer network used as a kind of bulletin board 
for hackers. 

The network, called "Phreak Class-2600," exists only "to 
educate computer enthusiasts ... to penetrate industrial and 
government sector computer systems," Cook said. 

Authorities said they were led to the teen-ager partly through 
messages he left on the network bragging of having gained access to 
the AT&T computer files. 

Kathryn Clark, a spokeswoman for AT&T, said the company's 
security systems were triggered by Shadow Hawk's break-ins. 

An analysis of long-distance calls made from the youth's 
telephone indicates he also tried to enter computers at the 
accounts-payable department of the Washington Post and and other 
businesses, Cook said. 

A 17-year-old is considered a juvenile, the prosecutor said, and 
if investigators believe charges are warranted, the Justice 
Department would be petitioned for permission or the case could be 
turned over to local officials for prosecution under state law. 

Cook would not speculate on Shadow Hawk's motive, but he said 
some hackers, or computer buffs, like to see how far they can go 
with their machines. 


§ 1030. Fraud and related activity in connection with computers. 


(a) Whoever-- 


(1) knowingly accesses a computer without authorization 
or exceeds authorized access, and by means of such conduct 
obtains information that has been determined by the United States 
Government pursuant to an Executive order or statute to require 
protection against unauthorized disclosure for reasons of 
national defense or foreign relations, or any restricted data, as 
defined in paragraph r. of section 11 of the Atomic Energy Act of 


1954, with the intent or reason to believe that such information 
‘so obtained is to be used to the injury of the United States, or 


to the advantage of any foreign nation; 


(2) intentionally accesses a computer without 
authorization, or exceeds authorized access, and thereby obtains 


information contained in a financial record of a financial 


institution, or card issuer as defined in section 1602 (n) of 
title 15, or contained in a file of a consumer reporting agency 
on a consumer, as such terms are defined in the Fair Credit 
Reporting Act (15 U.S.C. 1681 et seq.); 


"(3) intentionally, without authorization to access any 
computer of a department or agency of the United Stated, accesses 
such a computer of that department or agency that is exclusively 
for the use of the Government of the United States or, in the 
case of a computer not exclusively for such use, is used by or 
for the Government of the United States and such conduct affects 
the use of the Government's operation of such computer." 

"(4) knowingly and with intent to defraud, accesses a 
Federal interest computer without authorization, or exceeds 
authorized access, and by means of such conduct futhers the 
intended fraud and obtains anything of value, unless the object 


of the fraud and the thing obtained consists only of the use of 
the computer; 


"(5) intentionally access a Federal interest computer 
without authorization, and by means of one or more instances of 
such. conduct alters damages, or destroys information in.any such 


Federal. interest computer, or prevents authorized use of any such 
computer or information, and thereby- 


"(A) causes loss to one or more others of a value 
aggregating $1,000 or more during any one year period; or 


"(B) modifies or impairs, or potentially modifies or 
impairs, the medical examination, medical diagnosis, medical 


- treatment, or medical care of one or more individuals; or 


"(6) knowingly and with intent to defraud traffics (as 
defined in section 1029) in any password or Similar information 


through which a computer may be accessed without authorization, 
if- 


"(A) such trafficking affects interstate or foreign 
commerce: ок 
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"(B) such computer is used by ос for the Government 
of the United States;". у 


shall be punished as provided in subsection (с) of this section. 


(b) Whoever attempts.to commit an offense under 
subsection (a) of this section shall be punished as provided in 
subsection (c) of this section. 


(c) The punishment for an offense under subsection 
(a) or (b) of this section is- 


(1)(A) а fine under this title or imprisonment 
for not more than ten years, or both, in the case of an offense 
under subsection (a)(1) of this section which does not occur 
after a conviction for another offense under such subsection, or 
an attempt to commit an offense punishable under this 
subparagraph; and 


(B) a fine under this title or imprisonment 
for not more than twenty years, or both, in the case of an 
offense under subsection (a)(1) of this section which occurs 
after a conviction for another offense under such subsection, or 
an attempt to commit an offense punishable under this 
subparagraph; and 


(2)(A) a fine under this title or imprisonment 
for not more than one year, or both in the case of an offense 
under subsection (a)(2), (a)(3) or (a)(6) of this section which 
does not occur after a conviction for another offense under such 
subsection, or an attempt to commit an offense punishable under 
this subparagraph; and 


(B) a fine under this title or imprisonment 
not more than ten years, or both, in the case of an offense under 
subsection (a) (2), (a)(3) or (a) (6) of this section which occurs 
after a conviction for another offense under such subsection, or 
an attempt or commit an offense punishable under this 
subparagraph, and 


_ (3)(A) а fine under this.title or imprisonment 
for not more than five years, or both, in the case of an offense 
under subsection (а)(4) or (a)(5) of this section which does not 
occurs after a conviction for another offense under such 
subsection, or an attempt to commit an offense punishable under 
this subparagraph; and 


(B) a fine under this title or imprisonment 
for not more than ten years, or both, in the case of an offense 
under subsection (a)(4) or (a)(5) of this section which occurs 
after a conviction for another offense under such subsection, or 
an attempt to commit an offense punishable under this 
subparagraph;". 


(d) The United States Secret Service shall, in addition to 
any other agency having such authority, have the authority to 
investigate offenses under this section. Such authority of the 
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United States secret service shall be exercised in accordance 


with an agreement which shall be entered into by the Secretary of 
the Treasury and the Attorney General. 


(e) As used in this section - 


"(1) the term "computer" means an electronic, magnetic, 
optical, electrochemical, or other high speed data processing 
device performing logical, arithmetic, or storage functions, and 
includes any data storage facility or communications facility 
directly related to or operating in conjunction with such device, 
but such term does not include an automated typewriter or 


typesetter, a portable hand held calculator, or other similar 
device; 


"(2) the term "Federal interest computer" means a 
computer- 


"(A) exclusively for the use of a financial 
institution or the United States Government, or, in the case of a 
computer not exclusively for such use, used by or for a financial 
institution or the United States Government and the conduct 
constituting the offense affects the use of the financial 
institution's operation or the Government's operation of such 
computer; or 


"(B) which is one of two or more computers used in 
committing the offense, not all of which are located in the sàme 
State; 


"(3) the term "State" includes the District of Columbia, 
the Commonwealth of Puerto Rico, and any other possession or 
territory of the United States; 


"(4) the term "financial institution" means- 


"(A) a bank with deposits insured by the Federal 
Deposit Insurance Corporation; 


"(B) the Federal Reserve or a member of the 
‘Federal Reserve including any Federal Reserve Bank; 


"(C) an institution with accounts insured by the 
Federal Savings and Loan Insurance Corporation; 


"(D) a credit union with accounts insured by the 
National Credit Union Administration; 


"(E) a member of the Federal home loan bank System 
and any home loan bank; 


"(F) any institution of the Farm Credit System 
under the Parm Credit Act of 1971; 


"(G) a broker-dealer registered with the 
Securities and Exchange Commission pursuant to section 15 of the 
Securities Exchange Act of 1934; and 
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"(H) the Securities Investor Protection 
Corporation; 


"(5) the term "financial record" means information 
derived from any record held by a financial institution 


pertaining to a customer's relationship with the financial 
institution; 


"(6) the term "exceeds authorized access" means to 
access a computer with authorization and to use such access to 
obtain or alter information in the computer that the accesser is 
not entitled so to obtain or alter; and 


"(7) the term "department of the United States" means 
the legislative or judicial branch of the Government or one of 
the executive departments enumerated in section 101 of title 5." 


"(£) This section does not prohibit any lawfully authorized 
investigative, protective, or intelligence activity of a law 
enforcement agency of the United States, a State, or a political 
subdivision of a State, or of an intelligence agency of the 
United States." 
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New federal law bolsters 
computer security efforts 


= By J.J. BUCK BLOOMSECKER i 


ith the passage this month of & 

strengthened federal law, the 

Computer Fraud and Abuse Act 

of 1986 [CW Oct. 13] and new 
computer crime prohibitions in New York 
and Indiana, computer professionals can 
now use legal weapons against computer 
crime as never before, The federal govem- 
ment and most states now explicitly pro- 
hibit a range of computer crimes, which 
Tepresents an unprecedented opportunity 
for the computer security professional to 
use the law as an adjunct of security poli- 
су. : 

So far, however, it seems that corporate 
and government victims of computer crime 2 
have shown bttle interest in going to court. ® 

A computer crime census by the National 
Center fot Computer Crime Data, a re- 
search institution in Los Angeles, was able 
to locate only 75 prosecutions pursuant to 
38 states' computer crime laws. At a rate of $ 
fewer than two per state, the prosecution 
activity thus far is hardly frightening to a 
would-be erabezzler. Though not as extreme 
as the Federal Bureau of Investigation's 
estimate that only one of 20,000 computer 
criminals goes to jail, the result of the 
census is nearly sufficient to encourage 
crimes. As long as criminals believe that 
the odds against punishment are great, 
their motivation will be accordingly great. 

Using the criminal Justice system to pro- 
tect all of us is, to some extent, an obliga- 
tion of citizenship as well as a time-tested 
Social insurance strategy. Thus, one cannot 
discuss computer crime law without raising 
the major question every computer user 
must eventually face; Should we report а 
computer crime? 

‘The importance of this question is under- 
lined by the fact that short-term, narrow 
self-interest may well dictate а strategy 
opposite to that of long-term social respon- 
sibibty. A number of victims of computer 
crime have confided, for example, that 
they did not report and prosecute computer 
«rime cases because of embarrassment. 

Another explanation is that it seldom 

Seems cost-effective to be involved in a 
computer crime prosecution, The time in- 
volved in assisting prosecutors and investi« 
gators, the amount of unfavorable publici« 
ty a trial may involve and the relatively 
low probabihty that the defendant will 
make full restitution — all of these factors 
make it easy for a coraputer erime victim to 
conclude that the costs of prosecution out- 
weigh the benefits. 

But from another perspective, there 
must be 2 investment of faith in the erimi- 
nal justice system as a preventer and detec- 
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tor of computer crime, or else the system 
will have no deterrent effect at all. 

Knowing exactly what the law prohibits 
should facilitate more informed = and ide- 
ally more responsible — reactions in the 
increasingly likely event that your comput- 
er system becomes the scene of a computer 
crime, What follows is a summary of the 
provisions of the federal and state comput- 
er crime laws, based on the ongoing re- 
search of the National Center for Computer 
Crime Data. 


‘Democratization’ defined 


Computer crime is becoming increasingly 
hkely because computer technology is be- 
coming more accessible, It is, unfortunate- 
ly, beconung “abuser friendly.“ We call 
this trend the democratization of computer 
erime, 

Democratization із the spread of comput- 
ing to a far larger segment of the popula- 
tion in the last several years. With it has 
come a consequent increase in opportuni- 
ties for anyone who wants to become some 
sort of computer criminal. Further = and 
unfortunately without any element of 
choice == virtually anyone can now become 
а Computer саме victima, 

The technology of computer erime has 
been democratized to the point where a 
modem, the most commonly used tool for 
hacking, can easily be bought for less than 
$500. And many computer criminals have 
received on-the-job training. Employees 
represent a far more significant computer 
сие threat than do juveniles or tradition · 
al crimunals. The number of potential ега“ 
ployee erimunak grows as more jobs 
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Who commits computer crimes? 
Number of cases brought to trial nationwide before 


February 1986. 
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involve computer use, 

The largest category of defen- 
dants in the National Center for 
Computer Crime Data survey was 
employees. Included here are pro- 
grammers, bank tellers, input clerks 
and other employees with access to 
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their companies” 
systems. 
Employees rep- 
resent а contingat 
threat, since they 
have far greater 
ability to do dam- 
age and far more 
systera-specific in- 
formation to base 
their efforts upon, 
In addition, 
they often have 
more of a finan- 
cial motive to 
commit а crime 
У and often more 
psychological mo- 
tivation to hurt 
the chosen victim, 
Cases of mal- 
cious damage to 
computer systems 
are primarily 
cases involving 
employees or for · 
mer employees. 
Within the gen- 
eral category of 
employees, con- 
sultants as а 
group also stand 
out as particularly 
noticeable in the 
computer crime 
cases the National 
Center for Computer Crime Data has. 
studied. 

The computer crime census did 
not break out information ол consul- 
tants, so no exact figures are avail- 
able, However, the raw data suggests 
that a number of the programmers 
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all consultants are 


of cases, individ- 


counted were ac 
tually consultants 
or temporary em- 


do a specific job, 
In many cases 
these work rela- 3 
tionships were 
poorly defined in 
the employment 
contract, or there 
was no written 
contract at alk 
Without in any 
way implying that 


to be feared == no 
more than it is im- 
plied that all em- 
ployees or aH 
youths are to be 
feared ~m it is im- 
portant to note 
that in а number 


vals from outside 
a company gamed 
information ла the 
course of consult- 
ing work and then 
used the informa- 
tion against the company through a 
computer crime. 

One such case was the case of _ 
Stanley Mark Rifkin, who stole 810.2 
тооп from the Security Pacific Na- 
tional Bank using his knowledge of 
its wire transfer system, which he 
gained while he was working for the 
bank, 

In another case, a consultant who 
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was hired tó assist a company in 


gaining the necessary environmental 
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introduce yourself to complementary 082 and SQUDS training from the specialists with a reputation for quality. 
instructor-led trairur q from OBMI and СВТ from The Courseware Developers, 
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Instructor-led Training 
® 2 years experience іп 082 and 50/06 training. 
@ 1st company after IBM to offer 082 and SQL/DS 


traning. 


€ 2nd most widely used vendor in classroom instruc 
tion according to the 1985 BSI OP Training Survey. 


€ 7-course curriculum in 082 and 501/05 „= for 
designers, programmers, ОВА5 and end-users. 


€ Productivity-oriented instruction with machine 
Orkshops. 
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€ Consistently high аџаму instruction with an 
excellent reputation since 1973. 


For further information and = 
FREE OP Education Catalog, 
сай Jan Greening 


(203) 646-3264 
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before February 1986, 
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and zoning permits to begin manu- 
facturing computer disks threatened 
to sell the formula for the production, 
of disks to a competitor unless his 
employer paid him a ransom. He was 
easily convicted when he made his 
offer to an FBI agent posing as an 
agent of Nis company. 

Computer crime laws are our па“ 
tion's reaction to the types of com- 
puter crimes that have been reported 
and that it is feared will occur xa the 


Computer Based Training 


€ Aftitiate of DSMI, 


€ Courses in QMF/SQt and SOL Application 
Programming for both 082 and 50005 


environments, 


€ Available for IBM PCs and mainframes. 
€ Excetient reputation for high quality, 


thorough СӘТ, 


€ Interactive instruction designed to 
stand alone or complement instructor-led 


training. 


For further information and 
FREE trial offer, сай 


Courseware 
— Developers 


$3 f. Center Street, Manchester, CT 06040 (203) 6464105 
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The goal of these laws is to define those acts that 
will be punished in hope that the threat of 
punishment will deter some individuals from 
committing the acts. 


future, The goal of these laws, 1 
believe, is to define those acts that 
will be punished in hope that the 
threat of punishment will deter some 
individuals from committing the 
acts. The purpose of this section is to 
summarize the types of acts that the 
09 crime laws atteropt to cora- 
t. 


Money theft. Many computer 
crimes involve theft of money. These 
range from complex bank frauds like 
the Wells Fargo theft to simple, even 
trivial falsifications of records that, 
Allow money to be rusappropriated. 
It is the "big-kiling" case that legis- 
lative testimony focuses on primari- 
ly, since few manual system crimes. 
involve sums as large as those in the 
Equity Funding case, in U.S. у. Rift 
kan or in U.S. у. Smith, Lewis and 
Marshall. 

Service theft. Use of computer 
services for one's own benefit may 
de for commercial or noncommercial 
purposes. An example of the latter is 
the case of a programmer who kept 
private files on the New York City 
Board of Education computer. He 
was found not guilty because the 

State theft of services law was held 
not to apply to his actions. 

In contrast, in Indiana, a county 
employee was convicted of theft ua- 
der the state's new criminal code for 
using less than 10 dollars” worth of 
the memory of a county computer 
system. ү 

А сазе involving a Long Island, 
N.Y. university computer system 
demonstrates the commercial use of 
computer services, In this case, the 
manager of the computer center and 
his assistant used the school’s com- 
puter to service commercial accounts. 
for their own enrichment. They re- 
ceived at least $53,000 in revenue 
from one of their clients. 

Program aad data theft. Data and 
programs are themselves valuable 
property and thus are the subject of 
theft from computer systems, Em- 
ployees have been charged with com- 
puter crime or trade secret theft on 
several occasions involving disputes 
between eraployee and employer as 
to whatthe employee is entitled to 
take upon leaving the company, Ina 
number of these cases, the ех-егох 
ployee is now employed ia, or the 
owner of, a competing business. 

Date alteration, Some changes 10 
data allow criminals to derive sꝛgmf - 
icant gains, tangible or intangible, A 
recent prosecution ia Los Angeles 
resuked in a guilty plea by an em- 
ployee of the University of Southern 
Cahforma who had been taking pay- 
ments from students and changing 
their grades in return. 

Other reported schemes involved 
changes ia credit information and 
changes 1A department of motor ve- 
Жісіев records that facihtated the 
theft of the cars to which the records 
referred. 

Program damage, Programmers 
Талаһаг with а system can до consid- 
жғаМе harm Бу erasing or replacing 
parts of major programs. 

А recent case involved a plan to 
erase the operating systems of two 


computers maintained by a Los An- 

geles corporation that operated sev- 

eral restaurants and fast-food out- 
ts. 

In another case, a “logic bomb" 
was used to interfere with opera- 
tions at the Department of Water 
and Power in Los Angeles. A logic 
bomb is a prograra that causes а 
computer system not to operate as it 
should. 


Data destrection, Mostly as acts 
of mischief, contents of files Nave 
deen destroyed In Saa Francisco, 
United States Leasing International, 
Inc, found that several people re- 
placed words in their files with curse 
words, friends’ names and similar 
material, 

Maticious access. One of the lead- 
ing issues in reaction to hacking is. 
the problem of what to do when a 
hacker gets access to a computer sys- 
tem, reads some files but nether 
steals nor damages anything, This 
situation is becoming increasingly 
coramon in the computer crime cases 
that are prosecuted. 

Ta Catifornia, a court found that 
the typical computer crime statute 
language prohibiting "12621541005" ac- 
cess to a computer system did apply 
to users gaining access to others’ 
computer systems. In some of the 
charges against the defendant in this 
case, there was evidence of not just 

"access but also of damage to the 
computer system, 

Violation of privacy. A consistent 
fear relating to computers is that the 
computer will facilitate invasions of 
privacy. Some jurisdictions == par- 
ticularly ia Europe, where privacy 
protection is more advanced == use 


"administrative law to protect priva- 


cy more frequently than they use 
criminal Law. 

With the growing awareness of 
the dangers that coraputer crime 
poses to average citizens, it can be 
anticipated that invasions of privacy 
wil increasingly be punished 
through the use of computer crime 
law. Several examples of this sort of 
prosecution already exist, 


What assets do the laws protect? 


Criminal law can be seen as the 
way in which society defines which 
assets it will protect. Thus the defi- 
nitions contained iA the computer 
crime laws are important because 
they make clear the extent to which 
computer crime law will protect the 
items with which a data processing 
professional comes in contact, 

The common law frequently limits 
the definition of property to tangible 
items. Where computers are in- 
volved, this hmitation is significant, 
Much of the value in a computer 
system consists of intangibles =» es- 
pecially data and programs. 

Some of the most difficult issues 
in computer crime hitigation involve 
the fact that much of the computer's. 
Operation consists of changes за elec- 
trical charge on Various media or 
reprodaction of those charges. 

These electrical charges are not 
traditionally considered tangible, 
and there 15 considerable question as 


A summary of the 47 state 
computer crime laws 
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Every state except Arkansas, Vermont and West Virginia has enacted 
computer crime laws. Though they unanimously classify violations as criminal, 
the different state laws vary widely in the acts they forbid and the репа ес 
they mete out. 
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to whether computerized data falls 
within the traditional legal concepts 
of property. 

Thus, if one could steal informa- 
tion without taking anything physi- 
cal, it could be (and in some courts 
has been) deemed that there has 
deen no "taking" that is sufficient to 
constitute theft, The definitions used 
ia the computer crime laws appear to 
aim at reducing this problem 

For example, a group of private 
insurance investigators took doctors” 
{Wes without authorization, copied 
the contents of the files and then 
returned them. The investigators 
were prosecuted for theft, and their 
сазе was dismissed. 

The Colorado Supreme Court 
ruled that since the investigators 
had no intent to permanently de- 
prive the owners of the files of any- 
thing and sought only the 1 
formation the files contained, the 
Colorado theft law did not authorize 
prosecution for theft. Analogously, 
many malicious mischief statutes 
prohibit only damage to “real or per- 
sonal property.” 

Te is not at all clear that electrical 
impulses on a computer medium are 
real or personal property or that a 
change in the impulse is damage to 
the medium itself. 

For reasons such as this, there are 
provisions in virtually aM computer 
crime laws that define property 
rauch more broadly, including intan- 
Eble data, software as well as infor- 
mation. 

What acts are prohibited? 


The 47 state computer crime laws 
and the two federal computer crime 
laws that have deen passed in the 
last decade are reactions to a number 
of perceived and actual difficulties 
Ча applying common law criminal 
prohabitions to the types of interfer- 
ences with computer systems that 
have been discussed above. 

The fears motivating the institu- 
tion of these laws revolved around 
the possibility of criminal behavior 
involving the computer either as the 
target of a crime or as the vehicle 
through which a crime might be com- 
mitted. 

Most state laws, and the federal 
Jaws discussed below, can be divided 
into four categories: definitions of 
computer assets, definitions and pre- 
senptions of criminal behavior, pun- 
ishment provisions and ancillary 
provisions. 

The following summary attempts 
to describe the behavior forbidden 
by the various laws (see chart p. 52), 
the types of computer assets that are 

by the laws and a number 
of the details that determune the ap- 
plication of these laws to specific 
fact situations. 


Federal computer crime law 


At the end of 1984, the first feder- 
al computer crime law was passed. 
This bul was a compromise version 
of H R. 5616, crimunahzing оламсһо- 
пред access to classified national se~ 
curity information or information in 
certaia financial records. 

Additionally, certain unautho- 
nized access to computers operated 
on behalf of the government was 
ertwinahzed. 

This month, the second federal 
4 er crime law was passed This 
Dill, called the Computer fraud and 
Abuse Act of 1986, or HR 4718 in 
its House version, 1» the result of 
further hearings into the problem of 
computer crime by the House C'om- 


COM UHR WON O 
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The definitions contained in the computer crime 
Jaws are important because they make clear the 
extent to which computer crime law will protect the 
items with which a data processing professional 
comes in contact. 
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mittee on the Judiciary and the Sen- 
ate Judiciary Committee, 

Mindful of questions of separation 
ol power, the first federal computer 
crime bill did not extend its coverage 
to computers operating in interstate 
commerce. : 

The 1986 bill protects these com- 
puters against access with intent to 
defraud, access resulting in more 
than $1,000 1055 and access to cer- 


Rois nm 


gress apparently felt that this ех- 
pansion of jurisdiction was appropri- 
ate, The current computer crume law 
defines action as criminal if an indi« 
vidual does the following: 

e “Knowingly ... obtains informa- 
tion that has been determined by the 
0.5. Government to require pro- 
tection against unauthorized disclo- 
sure for reasons of national defense 
or foreign relations... or any re 


stricted data." 


tain medical computer systems. It 
also prohibits trafficking ia comput- 
er access passwords, which affects 
interstate commerce, 

The more extended coverage was 
originally dropped in order to reach 
a compromise with legislators who 
hesitated to expand federal jurisdic- 
tion before further study demon- 
strated the need for it. 

But after the 1986 hearings, Con- 
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e “Intentionally ,.. obtains infor- 
mation contained in a financial rec- 
ord of a financial institution .,, or 
contained in a file of a consumer 
reporting agency on a consumer, as 
such terms are defined in the Fair 
Credit Reporting Act.” 

e “Intentionally accesses а com- 
puter without authorization if such 
computer is exclusively for the use 
of the Government of the United 
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States or, in the case of a 
computer not exclusively for 
such use, if such computer is 
used by or for the Govern- 
ment of the United States 
and such conduct affects 
such use.” 

‘Knowingly and with in- 
tent to defraud, accesses a 
Federal interest computer 
without authorization, or ex- 
ceeds authorized access, and 
by. means of such conduct 
furthers the intended fraud 
and obtains anything of val- 
ue, unless the object of the 
fraud and the thing obtained 
consists only of the use of 
the computer.” 

e “Intentionally accesses а 
federal interest computer 
without authorization, and 
by means of one or more in- 
stances of such conduct al- 
ters information in that com- 
puter, or prevents 
authorized use of that com- 
puter, and thereby causes 
loss to one or more others of 
a value aggregating $1,000 
or more during any one-year 
period, or modifies or im- 
pairs... the medical exami- 


+ nation . . diagnosis 


treatment . or care of one 
or more individuals." 

e “Knowingly and with in- 
tent to defraud trafficks... 
in any password or similar 
information through which a 
computer may be accessed 
without authorization if (a) 
such trafficking affects in- 
terstate or foreign com- 
merce; or (b) such computer 
is used by or for the Govern- 
ment of the United States." 

The 1986 computer crime 
law has eliminated an incon- 
sistency between most state 
laws and the 1984 federal 
law. Like the state laws, the 
1986 law explicitly criminal- 
izes attempts and conspira- 
cies to commit the crimes de- 
fined in the federal law. 


Defining terms 


Unlike the state laws 
based on either the Florida 
model or the Federal Com- 
puter Systems Protection Act 
(S. 1766), the new Section 
1030 of Title 18 U. S. Code 
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defines only six terms, three 
of them in ways relevant 
only to federal law. 

It defines "computer" ina 
very extensive manner, in- 
cluding "electronic, magnet- 
ic, optical, electrochemical or 
other high-speed data pro- 
cessing device(s)." The defi- 
nition of computer includes 
data storage or communica- 
tions facilities directly relat- 
ed to, or acting in conjunc- 
tion with, a computer. 

A federal interest com- 
puter," which is protected in 


Escape . 
Datapoint! 


With DB/C Compiler/ 
Interpreter you can run 
your Datapoint DATABUS™ 
programs on ІВМ, АТАТ, 
SPERRY, PRIME and 
dozens more high 
performance computers. 

See why hundreds ot 
companies have chosen 
the Guaranteed 
Performance of DB/C 
for their conversions. 

Call now for your tree 
technical information 
package. 


(312) 572-0240 


Or write: 

DB/C 

Subject, Wills & Company 
800 Enterprise Dr. 

Oak Brook, iL. 60521 


поднета на ы! пашом OCD 


“Pharaoh” every step of the way. 
Full-featured 


Ш 
ІШІ 
T 


Graphi строги 


visual project management software 

from ISSCO. 

ТЕШ PLAN ® The Project mas 
Manager’s Project Manager M : 
Whether the Great Pyramids of Egypt or Clear Results 


the latest high-tech project, TELLAPLAN 


gives you the power to develop your plan 
and then follow through on target, on 
budget, on time. And you can brief the 


TELLAPLAN Professional and TELLAPLAN 
Expert have all the features you need: 


mM [ре 


Sections 4 and 5 of the bill, is 
defined as “опе of two or 
more computers used in com- 
mitting the offense, not all of 
which are located in the 
same state.” In addition, Sec- 
tion 6 contains an even 
broader jurisdictional stan- 
dard, where the criminal of- 
fense "affects interstate or 
foreign commerce.” 

Federal law defines "ех- 
ceeds authorized access" as 
"to access a computer with 
authorization and to use 
such access to obtain or alter 
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Intent with which а comput- 
er crime зз alleged to have 
deen committed are knowl 
edge, purpose, malice and 
authonzation, As in most of 
the criminal law, computer 
crime law requires at the 
Very Jeast ай awareness of 
what the person committing 
the crime 1$ doing. 

This knowledge їз ex- 
pressed by different words 
in different statutes. Includ- 
ed are the terms “knowing,” 
“willful” and "intentional" 

In the absence of judicial 
interpretations to the coa- 
trary, it appears appropriate 
to interpret аЙ of these 
‘words to mean that the actor 
knows what he or she is do- 


ing. 

Legally, this knowledge 
need not necessanly extend 
to the actual consequences of 
one’s actions, as Yong as 
those consequences are re- 
sonably foreseeable from the 
actions that were known. 

For instance, members of 
the "414 gang" tesufied that 
they would try to get access 
to computer systems when 
they did not know the identi- 
ty of the owners of those 
systems. Thus, they could ar- 
fue that unless a certain 
computer system contained 
an introductory message 
alerting them that the sys- 


Хеге probubuted anauthonzed 


access, they would have no 
way of knowing that such 
was the case, 

M contrast to the former 
terms, the use of the word =~ 
"purpose" DA many computer 
erime laws would appear to 
require proof that someone 
charged under those Jaws 
dad a specific intent to com- 
mut a certan type of ere, 

Consider the language 
that says "Any person who 


"es a ACCESSES , «. а Corm pater 


в с» for the purpose of devis- 
ing any scheme or artifice to 
defraud... is gualty of a 
computer crime. Knowingly 
getting access into а comput- 
er system without the intent 
to devise a scheme to de- 
fraud would not be a crime 


‚ mader this language. 


11, Cor example, а hacker 
only wants to look around, 
Not to change data, steal 
anything or otherwise dis- 
горе the system, he or she 
would not be hadie under 
suck a provision, 


Malice 


Mahce is generally inter- 
preted as meaning a specifie 
intent to do harm, Using the 
hacker example again, и 
would appear to be a defense 
toa statute forbidding mah - 
crous™ access to a computer 
System Co prove that the ac- 
cused did not intend to do 
harm. 

For example, the defen- 
dant wn оре v. Austin con- 
tested this issue in a саге 
recently xoncluded in Los 
Angeles [a response fo the 
charge that he had таћ- 
€yously accessed à number of 
computer Sy stems, Austin ar · 
gued that м accesses were 
Tux meant to Farm айу of tte 
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Electronic banking spawns 
highly lucrative crime wave 


w^ ..- 


By AUGUST Sc 


One weekend in 1965, a gang of safecrackers 
used a 70-mm, antitank gun to blast their way 
into а Brink's vault ia Syracuse, N.Y, They made 
away with about $300,000. 

Today's successful safecracker has gone elec- 
tronic. As vaults give way to electronic funds 
transfer (EFT) systems, security experts are con- 
cerned that EFT thefts could run into the tril 
bons of dollars. A bank security officer once 
remarked, "It's something that really scares us. 
It’s frightening.” Д 

EFT makes police and banking officials ner- 
vous and with reason, More than $2 trition . 

moves daily through global EFT networks. Auto- 

rated teller machines (ATM) alone handle more 
than three bition transactions involving $250 
dithon annually, But the Interbank Card Associa- 
tion, which represents the Mastercard system ` 
and other banking groups, fears that ATMs are 
vulnerable to theft. 

Ы The US, Department of Justice has already 
identified four areas in which EFT systems are 
vulnerable; unauthorized use of access devices, 
frauds by authorized users, internal manipula- 
tions by dishonest employees and sabotage. The 
federal government, the biggest user of EFT 
systems, is particularly concerned with the ma- 
nipulation of these systems by dishonest insid- 
ers. As Mastrated by the following examples, 
others share this concern: 

ө In Switzerland, a gang of electronic thieves. 
intercepted an EFT transmission and diverted 
the funds to their own accounts. 

e {а Japan, a communications engineer with 
the Nippon Telephone & Telegraph Co. tapped a 
bank's EFT lines and gained access to the ac- 
count numbers of its cash-card customers. 
Armed with these and counterfeit cards, he took 
the dank for more than 170 mon yen before 
being discovered. 

o la the U.S., a bank data entry clerk stole 
more than $25,000 in a two-month period simply 
by manipulating the automated central informa- 
toon files. This enabled him to access customer 
accounts through the bank's ATMs. 

According to the Americana Bankers Associa- 
tion, more than 60% of the 225 banks that it 
surveyed had been the victim, at least once, of an 
EFT fraud. Many of the offenses had been com- 
matted by dishonest insiders, _ 

A series of hearings on EFT systems by the 
US, House Banking Committee came up witha 
number of findings. First, "remote muggiAgs" 
lavolviag ATMs were beconung а problem. 
Thieves were finding it lucrative to rob people 
who had just withdrawn money from ATMs. 
Also, the theft of ATM cards and codes had 
become commonplace. Next, impersonating bank 
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Excerpted from Techno-Crimes, copyright © 
1987 by D.C, Heath and Co. Published by Lering- 
ton Books, Lerungton, Mass. 
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officials, thieves were telephoning banks and 
their customers to obtain secret codes. Lastly, 
dishonest customers were making withdrawals 
while claiming they had lost their ATM cards. 
Although there 15 mounting evidence that EFT 
crimes are increasing. a consensus Nas not yet 
been reached on what exactly constitutes an EFT 
crime or on the scope of the problem, Suffice it to 
Say that these crimes аге unlawful acts directed 
at == or making use of = one or more EFT 
systems. Annual losses attributed to EFT crimes. 
are said to range any where from 100 mion to 
several bilion dollars, depending on the source. 
‚ Computer crime has been in the imebght of 
criminology in recent years, and EFT thefts and 
frauds, one of its offshoots, has recently been 
scrutinized by such groups as the American 
Bankers Association and various law enforce- 
ment and congressional commitees. From these 


Sources and from the crimes that have surfaced, 


we find that EFT offenses can take the following : 
forms: * 
* Physical attacks directed at EFT systems or 


which, for example, the user falsely claims that 
a third party used his access device to make 
withdrawals from his account. 

* Fraods and thefts by dishonest insiders: 
Armed with a customer's card and personal iden- 
tification number, these thieves carry out onan- 
thonzed withdrawals and transfers. — 

o Thefts based on error == that is, situations 
in which a dishonest customer steals funds erro- 
neously deposited ia his account, 

Unauthorized transactions by outsiders, of. 
ten carried out with the help of dishonest em- 
ployees. 

_ * Blackmail, especially in cases in which the 
account holder occopies a sensitive political posi- 
tion. 

• Manipulation of data, often involving the 
internal manipulation of the system's software 
or hardware. 

• Extortion, especially when terrorists and 
other political extremasts are involved. . 

e Electronic interceptions, often directed ata 
system’s communications hnes. 

e Counterfeiting of access devices, a carryover 
from the credit card industry, 

In part. the lack of valid data ia the area of 
EFT crime mast de attributed to the financial 
industry. Fearful that if might scare away exist- 
ing or potential EFT customers, the industry has 
often swept the problem under the rug. The 
financial community does, however, recognize 
the threat of EFT crime, Efforts are underway to 
educate EFT users on the need for security and 


E 


2 


Invisible safecrackers: Today's thieves work through wires 


Yo enact state laws that would facihtate the 
prosecution of EFT criminals. The U.S. Congress 
just passed a law making it a federal crime to 
misuse access devices. 

New security devices are also hitting the mar- 
ket, For exarople, plans are afoot to improve 
access security through the use of fingerprint 
scanners. A scanner would compare the user's 
fingerprints with those stored in digital form ix 
the bank’s computer, Depending on whether the 
prints matched, it would either permit or deny . 
access to the system, Chemical Bank, First Inter- 
state and Wells Fargo Bank, М.А. аге exploring 
their possible use. 

There are also plans to replace present ЕРТ 
cards with smart cards <» "plastic money that 
talks." First test-marketed in Europe, the card 
contains a tiny memory and а microcomputer ie 
asuicon chip that is the size of a smal coin. The 
microchip contains both the customer’s account 
number and credit timit; data can be encoded on 
it for up to 180 separate accounts. 

The smart card is not without its drawbacks. 


any of their components. .. . It is costIy to produce =» more than $15, 25 . 
• Robberies, thefts , ы compared with 65 cents 
‘and other attacks that y y for the type of cards cur- 
are directed at users of “ rently used, conside 
systems, . Also under. T- 

* Unauthorized use of One selling pitch of the ation are such safe. 
access ‘devices such as. cashless society is that it guards as voice identifi» 
саг 2115, codes, ac- p, cation, hand pattern 
count mumbers, Dass | will serve to curtail crime. identification and signa- 
words or any other de- owever, it has зраюле, ture identification, АМ ot 
vice used to gain access new, more costly crimes. these are costly and safe~ 
Хо an account, _ ` guard only entry into the 

* Fraud and thefts by system, not the total sys- | 
authorized | users in tem. They must be 


viewed as merely the beginning un a long and 
drawn-out process to make EFT systems secure. 
One of the seling pitches of the cashless 
society has been that it will serve to curtail 
enme, By that, its proponents must obviously 
mean traditional crime, since the cashless society 
has already spawned new and more costly 
erimes. Difficult to detect and guard against, 
these crimes pose a challenge to the viabihty of 
the financial sector = one that we have yet to 
address. 
| 
| 
! 


Asis the case with computer crime, a lackof 
confidence in the ability of our criminal justice 
system to address these offenses only serves to 
reinforce the financial industry's retuctance to 
come forth and assist in identifying these of. 
fenses, Often when frauds surface, a financial 
institution's practice is to refer them to its in- 
house security staff for disposition. The wide 
variety of defuutions and procedures used by 
banks to record these frauds makes it easy to 
mask the crimes. 

We need to determine both the prevalence and 
characteristics of these crumes if we are to ad- 
Gress the problem, Without these, the task of 
developing safeguards and laws to tackle the 
problem could prove difficult, if not futile, 

Security is an important first step in secunag 
EFT systems. But of even greater importance is 
the need to carefully scrutinize the cashless 
revolution, Its impact and implications for our 
society аге too great to be left solely ia the hands 
ofthe financial community, a 
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computer systems and thus were not 
malicious. 

His argument, however, was yn- 
successful, and after a court trial. he 
was incarcerated for a presentence 
probation examination and then 
placed on felony probation. 


Nonmalicious access 


Ia order to ehm Rate the require- 
ment of malice, some statutes have 
been drafted ex piscitly to punish 
псоллаһсюнч access. Subsequent to 
the fibng of the Austin case, for 
example, Cahfornia added a comput- 


er trespass section to its computer 
crime law, It prohibits entry into а 
computer system that is knowing 
and without authorization, but not 
malhcious. 

Ia another example, New Jersey 
law includes a pros ion defining 25 
ra "disorderlv person” one whó "pur- 
ру aad without authorization ac- 
cesses a computer . and t his act oa 
aloes not result in altermng, damage or 

destruction of any property or ser- 
vices" 

A number of statutes indicate that 
only "onaulborized access” to com- 


puter systems can he punished. Some 
Statutes explicitly define aut horiza- 
tion. Colorado, for example, detines 
authorization as "the express con- 
sent of a person hach may ми lude 


“an employee's job description to use 


sami person's coc pater computer 
Ret work. computer progran, com- 
puter soi lware, computer system, 
property or services" 


Defenses 


A number of the computer crime 
йаз им lade pros mons that can be 
used as defenses by those a cused of 


compater crime. The widespread use 
of computers, especially by omploy- 
ees, has deen responsible for a num- 
bet of prov mwns that dicate that 
any authorized use of a computer 
cannot give rise to hadahtx- As 
shown above, many of the statutes 
Мо this directly Their defimton of 
computer «rime by Prem oniy 
unauthorized ats. 

QCoenecteat law & eu creates 


awt honza wn” as an affirmative 


defense, pro^ ningrat "Tt hall de 
an al firmau e detense to a prosecu- 
tin for unauthorized acess toa 
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The determination of the punishment 
in a specific case will depend on the 
type of crime, type of harm, existence 
of enhancement provisions, existence 
of multiplier provisions and 
civil remedies. 


computer system that à per- 
son reasonably believed that 
the owner of the computer 
system, or г person empow- 
ered to license access there- 
to, would have authorized 
him to access without pay« 
ment of any consideration, 
of that person reasonably 
could not have known that 
lus access was unautho- 
пед” 


Analogously, though not 
quite so clearly, Cahforria 
appears to create a defense 
for computer access done 1a 


the course of one's employ- 
ment, 

It provides that “any per- 
son who intentionally and 
without authorization ас- 
cesses any computer system 
+ ey With knowledge that the 
access was not authorized 
Shall be guilty of a pubhe 
offense, This subdivision 
Shall not apply to any person 
who accesses his or her его“ 
ployer's computer system. 
computer network, computer 


Program or data when acting, 


witbun the scope of his or 
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SCAN/COBOL takes the effort out of program documentation, 
Nothing's more important to document than source code, but 


nothing gets done less. 


Now SCAN/COBOL will automatically document any COBOL 
programna matter how long or complex —in the source 


code, where it's most effective, 


No matter how many changes you make, SCAN/COBOL keeps 
aif your source level documentation up-to-the-minute, Whether 
it's your own COBOL program or а vendor's, SCAN/COBOL 
gives уои the critical Information you need - whenever you 


"need it-~in clear, easy-to-follow form, 


And SCANICOBOL guarantees that all your source code gets 
documented in exactly the same way Programmers will 
become productive sooner, develop reliable programs faster, 


and maintain them easier. 


SCAN/COBOL does what no other analysis tool can, it 
simulates the execution of every cleanly compiled program, 
SCAN/COBOL saves hours and hours of tos ung and computer 


tme by giving you critical Information that shows 
how your program will run. К highlights poorly _ 
structured code in simple, concise graphs; 


pinpoints the illegal use of keywords; 


and reveals hidden bugs and maintenance 25 
booby-traps-- ай before the program runs. ғ. 
« 


Group Operations, Inc, 
1119 Vermont Avenue NW 
Washington, OC 20005 


Ottices n Atlanta, Boston, Chicago, Dallas, 
Los Angeles and New York Find out how 


SCAN COBOL improves programmer productivity, 
ЖОР auditing and program documentation 
Сан Cheryl Maloney today at 1202) 887-5420 
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her employment.” 

The New York law allows 
as à defense the argument 
that the defendant had rea- 
sonable grounds to believe 
de or she was authorized to 
use a computer, to alter its 
data or to copy data or pro- 
grams. 


Texas law exempts em- 
ployees of commanications 
common carriers as well as 
electric utilities from tiabil- 
ity, so long as their actions 
were in the course of em- 
ployment and necessary tó 
protect the property of their 
employer, 

Kansas law makes it a de- 
fenseif “the property or ser- 
vices were appropriated. 
Openly and avowedly ander 
a claim of title made va good 
faith.” 


Punishment 


The range of punishment 
for computer crime is i= 
mense. R ranges fromiafrac 
tion treatment an Cahfornia 
requnngthe payment of a 
sraall fine to prison sen- 
tences as long as 10 years 
and fines that can be as 
mach as $100,000 in Ok1aho- 
хоз. 

The determination of the 
puxmshment а specific case 
v depend on the type of 
сплав, t pe of harm, exis- 
Vence of enhancement provi» 
sions, existence of maniplier 
provisions and civil reme- 
Ges. 

“The provisions of the 
1986 law make significant 
changes мо the structure of 
punishments for federal 
computer crimes. 

Crimes m volving access to 
classified information can be 
punished by a fine and/or 10 
years imprisonment. 

The earber bill's provision 
that the fine could be up to 
twice the value obtained by 
the offense has been 
dropped. and now the gener- 
al provisions of the Criminal 
Fine Enforcement Act ot 
1934 govern the allowadle 
fine. 

Farther, second offenses 
can be punished with 20 
years of imprisonment and/ 
or a fine, 

Violations of Section 3 of 
the 2835 law dealing with 
aanauthonzed access or Seç- 
tion & dealang with traffick- 
ing in passwords, can be 
pumshed with imprisonment 
fot one S ear or less and/or a 
fine. 

The same offenses or vio 
tations of Section 2, dealing 
with financial records, саа 
be punished wath amprison- 
ment for not more than 19 
sears If there has been a pri- 
or соленой for the same 
crime. 

Violations of Section 4, 
deahng with computer ac- 
cess With irent to COMMUTE 
fraud. orSectióa 5, deahng 
with akeration of computer 
могти кю e£ име отеле 
* Nh computer use, caa be 
pushed with up to five 
Sears морпмимпем and of a 
fine. 
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Sections 4 or 5 can increase 
the imprisonment to a term 
of 10 years. 
Attempts are treated the 
Same as completed crimes for 
purposes of punishment. 


Valuation 


One of the difficult issues 
ih computer cries is valua- 
tion. If the asset that has 
been damaged or taken can 
de freely traded ~ hke a 
personal computer or even а 
custom-made computer pro 
gram = then calculating the 
warket value of the lost or 
damaged asset is usually ad- 
equate. Other cases are not 
50 easily measured. 

A variety of measures of 
value are found да the com- 
puter crime laws: 

* Connecticut sets value at 
the market value or replace- 
ment cost at the time of vio- 
lation. 

ө Iowa calls the value of 
property taken or destroyed 
"loss" and defines it as the 
retail value or replacement 
or repair cost, whichever is 
less. 


Montana has a definition 
similar to Connecticut's. It 
includes the following: "The 
value of electronic impulses, 
electrotucally produced data 
or information .. or any 
other tangible or intangible 
item relatang to a computer 
v« „ Shall be considered to be 
the amount of economic loss 
that the owner of the item 
might reasonably suffer by 


Joss mclodes but is not Nimit- 
ed to consideration of the 
value of the owner's right to 
exclusive use or disposition. 
of the item.” 


Unresolved issues 


As indicated above, de- 
mocrauzation has been the 
biggest change in the com- 
puter crime landscape in the 
last few years. The most sig- 
nificant consequence is the 
fact that hacking remains 
more of a problem than ever 
before, 

The primary problem is 
the relative youth of the par- 
ticipants and the serrousness 
of the potential damage they 
can do, 

Federallaw is virtually 
useless where juveniles are 
concerned, Before а juvenile 
is tried іла US, federal 
court, the attorney general 
of the US, after investiga. 
tion, must file a certificate 
asserting that the juvenile 
court or other appropriate 
State court does not have ju- 
msdiction in the case or that 
it refuses to assume jurisdic- 


CORRECTION 


The correct name of the 
systems integrator men- 
tioned ra the story on the 
American Association o 
Reured Persons (Та Depth, 
Oct. 6115 American Man- 

“agement Systems, Ine, 
| 
а oen oe rend A nn pri ene ek 


tion => or that the state juve- 
nile system does not have ~ 
avaiable programs and ser- 
vices that are considered ad- 
equate for the needs of the 
juvenile. 

As а practical matter, this 
has meant that virtually all 
Juveniles who are arrested 
by the FBI have been re~ 
leased or have been referred 
to the local police for prose- 
cution. 

Few federal cases have 
been brought against these 
javenules. 


A related question is one 
‘of forming an appropriate 
corporate poticy to deal with 
minors. There are пум сале 
differences of opinion about 
the мегі degree of freedom 
that young computer enthu- 
siasts should be allowed in, 
their interaction with main- 
frames. 

A policy for minors 

While all responsible com- 
mentators agree that doing 


serous damage by changing 
data or programs is wrong, 


other questions are more dif- 
ficult: 

• Should hackers be hired 
to xAvestigate computer 
crime? 

* Will better security sim- 
ply lead to more efforts by 
hackers to break a computer 
system's security? 

* What is the appropriate 
punishment for someone 


“who is convicted of hacking? 


The company contemplat- 
ing taking action against a 
young computer user also 
WII want to avoid the ap- 


pearance of overreaction 
that seemed to accompany 
the raids by the FBI ia Ad- 
gust 1933, when ats agents 
seized the computers of 15 
Teenagers. 

Another case represents 
the need for careful atten- 
tion to the impressions that 
may result frora poorly con- 
sidered prosecution deci- 
sions, for example, the Tcim- 
pidis case that was 
prosecuted un Los Angeles in 
1934 and 1985. 

in this case, a systems 


ACCUNET* расе 
Provides Сов-Е е. 


WITH THE AT&T ACCUNET’ FAMILY OF DIGITAL SERVICES 
AND THE AT&T CONSULTANT LIAISON PROGRAM. 


high-quality, end-to-end digital 
bons, the smarter 
proposal is AT&T's ACCUNET 
Family of Digital Services. 

Our extensive line of digital 
Services, including DATAPHONE* 
Digital Service, AOCUNET* TL5 
Service, ACCUNET* Reserved 15 
Service, ACCUNET® Packet Ser- 
vice and ACCUNET* Switched $6 
Service, can answer virtually all 
of your customers information 


Exchange and Video Teleconfer- 
encing, to CAD/CAM and Bulk 
Data Transfer. 

All with excellent digital reti- 
ability and accuracy. 

Bot just as importantly, through 
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the AT&T Consultant Liaison Pro- 
gram. we can work with you to 
integrate these services to your 
proposals, so that your recommen- 
dations will maximize your chent's 
movement and management of 
information on a global scale, 

Ta addition, our CLP Network 
Communications Apphcations and 
Services manual (available for a 
small fee) provides you with a 
comprehensive fingertip reference 
for all of AT&T's wide array of 
network services. 

Р ^ short, the people and services 

of AT&T can help you make more 
informed, strategic recommenda- 
tions (0 solve your customer's 
complex business needs, 

And chats a smarter proposal 
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operator was charged with a crime 
for “publishing” a telephone compa- 
ny credit card number, 

There was no allegation that he 
dad posted the number on the bulles 
tin board system that he ran, but 
‘only that the act of operating his 
system made hiro a publisher of alt 


company to reduce the spread of bub 
letin boards, 

In the future, computer profes- 
sionals can expect to de increasingly 
challenged to define their responsi- 
«Му for the security of computer 

* systems. 

Otherwise, they will find others 

defining the responsibility for them. 


Таке the initiative 


A California case alleged that 
TRW, Inc. was ia violation of the 
Fair Credit Reporting Act for fading 
to take adequate steps to protect the 
privacy of information in ats comput- 


er data base. The case was settled 
before trial, prectuding a legal inter-- 
pretation of the metes and bounds of 
TRW's responsibibty. 

Citibank М.А, settled а civil action 
brought by the New York Attorney 
General's office, based іл part on 
inadequate secunty for its automat- 


the information contained on it. ed teBer machines, 

The case drew The future of com- 
considerable — atten- puter crime law is 
tion, since м suggest- y y ukely to see increas- 
ed а broad range of ing emphasis on 
cruminal Babehties In the future, what the computer 
for operators of bul- computer profes- user can do to pro 
letin boards. sionals can ex- tect the data and 

The comment of pect to be increas- computer services 
the telephone compa- БМ ly chall d that make up the 
ny representative =s ingly challenge heart of the enter- 

that next time he to define their rise, 
would pick someone responsibility The forward-took- 
who was really Sor the security ing student of data 
guilty — did httle to ofcomputer security may wel 
reassure those in the systems. contemplate the fact 
public who consid- that the “414 gang" 
ered the case as an case was used by a 
attempt by the phone number of editorial 


ists to demonstrate the relatively 
backward state of security aware- 
ness on the part of several of the 
gang’ $ Victims, 

* This attitude could easily trans- 
late into increased demands that 
businesses using computers develop 
greater security measures on their 
own or submit to governmental regu- 
lation to achieve the same end, 

If for no other reason, users 
Should improve their use of existing 


computer security tools, Шке comput- 


er crime laws, before demands rise 
for greater governmental involve- 
ment in the computer security area. 8 


VSAM Users: 


Challenge VSUM to design 
and manage your VSAM files. 


ТЗОЛЗРЕ and batch execution capability. 
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As a result of increased activity 
and increased calis for greater 
computer secunty, the number of 
participants in computer security 
has grown, offering a number of 
new choices for a computer securi- 
ty professional trying to decide 
how to proceed in the investiga- 

"tion or prosecution of a computer 
crime, Depending on the junsdic- 
tion and the case, any of the fol- 
lowing might be helpful. 

Local police. Los Angeles, New 
York, St. Louis and Chicago all 
have some form of computer fraud 
‘anit within their police depart- 
ments. Many other cities employ 
individuals who Rave been trained 
in computer crime investigations 
by the Federal Bureau of Iavesti- 
gation, International Association 
of Chiefs of Potice, local attorney 
generals’ offices or private 
groups. In Silicon Valley, local po- 
hee departments work together, 
sharing investigative and educa- 
tional efforts. > 

District attorney. A number of 
areas have had active district at- 
torneys prosecuting computer 
crime for several years. 

Та most states with computer 
crime laws, the district attorney is 
the prosecutor charged with pros- 

| ecuting computer crime cases. In. 
many jurisdictions, separate m- 
vestigative staffs or personnel аге 
attached to a specific unit of the 
district attorney's office, These 
investigators may be called on in- 
dependently of the police investi- 
gators. 

Which investigator to call їз 
seldom clear. It wid usually be 
determined by cooperation be- 
tween the prosecutors and iavesti- 
gators who become aware ofthe 
case. 

Attorney general's office. 
Though most states vest primary 
jurischetion in computer crime 
prosecutions to district attorneys, 
attorney generals’ offices 
throughout the country are in- 
creasingly becoming involved in 
computer crime investigations. In 
most states, the attorney general's 
office is empowered to investigate 
any crime and may prosecute the 
case itself or, more usually, will 
refer it to the local prosecutor for 
trial. 

FBI. The first law enforcement 
group to train а large number of 
its members ia computer crime 
law. the FBI has been active in 
computer crime investigation for a 
number of years. The 1984 federal 
computer crime law stipulates 
that the FBI and the Secret Ser- 
vice will iavestigate computer 
crime cases defined by that law, 
The Jaw calls for the secretary of 
the U S. Department of the Trea- 
sury and the U.S. attorney general 
Xo draft an agreement spethng out 
the two organizations’ Jurisdiction 
in the area of computer crime, 

Secret Service; fhe Secret Ser- 
vice maintains a traditional role in 
the inv ett m of crimes involv: 

зая counterfeit currency, With the 
new federal computer erine law, 

that role wall be expanded to i- 
clude all the computer crimes de- 

i scribed m the new Jaw, 


| To investigate a crime, call — 


US. Attorney. The US, Attor- 
теу" office has prosecuted а num- 
ber of the major computer fraud 
cases in history, without relying 
on computer cnme laws. The role 
‘of the US, Attorney is solely pro- 
secutorial, as the FBI does mach 
ofthe investigative work. 

Professional organizations, 
Those seeking assistance in the 
investigation of a computer спе 
or the application of computer 
crime laws to aspecific situation 
have a number of nongovernmen- 
tal sources to call ороп for help, 
including the following: 

* The American Society for In- 
dustrial Security is the leading 
professional security organiza- 
tion. Its active National Computer 
Security Committee consists of a 
number of experienced computer 
secunty professionals. 

• The Association for Comput- 
ing Machinery includes a special 
interest group on secunty, audit 
and control The group occasional- 
Iy publishes a newsletter, 

* The Computer Security Insti- 
tote is a private, for-profit organi- 

“zation that organizes а number of 
, COreputer security-related semi- 
gars and publishes a newsletter, а 
journal and a computer security 
reference book, 

е The Laformation System Secu- 
rity Associaton is a nonprofit na- 
onal group of computer security 
professionals with local chapters 
ia many cities. They Nave regular 
meetings and ай annual зета v 


* The National Center for Com- 


puter Crime Data is а nonprofit 
research institute that investi. 
gates computer crime, computer 
security and computer ethics. К 
publishes a book, the Computer 
Crime Law Reporter: a newslet« 
ter, “Conscience in Computing" 
and an annual statistical report, 
"Computer Crime. Computer Secu 
rity, Computer Ethics." 

* MIS Training Institute is a 
seminar company that offers a 
number of seminars on computer 
crime, computer security and aR 
aspects of DP auditing. 

* The EDP Auditors Association 
is a nonprofit organization that 
publishes a newsletter, sponsors 
seminars and certifies members as 
Certified Information Security 
Analysts if they pass а certifica- 
tion examination. 

Compater security vendors. 
Numerous companies are iavotved 
an selling computer security prod- 
acts. It is important to point out 
that these vendors can often offer 
invaluable assistance in process- 
ing a computer crime Case, partic- 
larly when the case involves an 
understand:n of the operation of 
the vendors’ products. 

Victims. Particularly in the 
Case of the Leleconumunications 
carriers, victims of computer 
crime may provide important as- 
ance LO other vctus or to po 
tential victums, СТЕ Telenet Com» 
munications Соғр,, for example, 
Ras provided significant asms- 
tance in а case that resulted ъл one 
of the first Thugs pursuant to the 
new federal computer crime law a 

“man $ J BUCK &LOOMSECKER 
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computer hackers. 

She said hackers tend to 
lose interest in schoolwork 
that is not related to comput- 
er science, and thus, their 
school grades plummet. Col- 
lege-age hackers tend practi- 
cally to live in the computer 
buildings on campus. 

Smith’s research provided 
additional characteristics of 
hackers: 

W They are almost 100% 
male, 

и Like computer program- 
mers, hackers are extremely 
bright, investigative and log- 


А ical thinkers, competitive 


and prefer structured but 
creative activities. 
Ш With every successful 


| action at the keyboard, hack- 
- ers see themselves as assert- 


— 


* 


ing authority over the ma- 
chine and whoever is 
connected to it, giving them 
a sense of power and control. 
Thus, they are more con- 


* cerned with gaining this sen- 


sation of power than they 
are with the effects of their 


. actions on others. 


@ Hackers tend to dabble 


at computer projects with no 


> 
> 
> 


> 


long-term goal and do not 
plan ahead. 
ш Hackers have little re- 


u 


24-hour restaurants. 


FD 


Conference. 


spect for those who know 
nothing about their favorite 
subject, computers. 

“Every aspect of their 
lives soon becomes linked to 
computers," Smith said, re- 
ferring to hackers’ social iso- 
lation from families and non- 
hacker friends. "Their 
Speech becomes short and 
precise in order to avoid any 


; ambiguity in communication, 


and they often use computer 
jargon which nonhackers do 
not understand," she said. 
But hackers find refuge in 
their strong bonds with oth- 
er hackers, in a hacker cul- 
ture where individual 
achievement is highly recog- 
nized. "Young hackers love 
to share information with 
each other concerning their 
hacker exploits,” Smith said. 
In fact, John F. Maxfield, 
а computer security consul- ` 
tant in Detroit who operates 
an investigative service 
called Boardscan, told Com- 
puterworld that one way to 
investigate hackers engaged 
in criminal activity is to 
catch them bragging about 
their exploits on electronic 
bulletin board networks. 
The conventional ap- 
proach to steering hackers 
away from criminal activity 
is to lecture them about com- 
puter ethics, but this ap- 
proach has had only mixed 
success, Smith said. Instead, 
the social and environmental 
forces that reinforce hacker 


hacker 


GAITHERSBURG, Md. — Track `” 
Hing a hacker? Look for a boy who 
zeats junk food or Chinese food from 


That is one of the characteristics 
"described by Julie A. Smith, an ana- 
Jyst for the government's National 
‘Computer Security Center, at the 
recent National Computer Security 


Because it is easiest to work on 
“computers undetected during the 
-wee hours of the night, and because 
many hackers are in school during 
the day, Smith explained, а hack- 
er's meals tend to be take-out junk 
-food eaten at the computer terminal 
„ог food eaten at 24-hour restau- 


* 


oe } 


1 


^ rants. In fact, Chinese food tends 
to be a favorite among college hack- 
ers, Smith said. 

This was just one of the charac- 
teristics Smith reported in a re- 
search paper that provides a psy- 
chological! profile of the hacker. 
She said the late hours and self- 
imposed confinement to computer 
rooms tend to reinforce the "envi- 
ronmental isolation’’ of most 

See HACKER page 65 


behavior must be changed, 
she asserted. 

“It appears asif the best 
way to combat the narrow- 
mindedness that young hack- 
ers often develop is to 
change educational patterns 
so that bright students with 
an interest in computers are 
not bored in school," Smith 
said. 

If schoolis more challeng- 
ing, teenagers with hacker 
personality traits may devel- 
opinterestsin subjects like 
music. 

Developing young hack- 
ers’ interests in noncomputer 
fields would further develop 
their intellectual abilities, 
givethem exposure to differ- 
ent environments and en- 
hance their social skills, 

Smith said. She praised a 
special Duke University pro- 
gram for talented students | 
that features a balance of 
challenging academic work 
and well-planned extracur- 
ricular activities. 

Furthermore, Smith sug- 
gested that “by allowing | 
young hackers to work with | 
computersinanenvironment  ' 
where the point of their 
work is more focused and su- 
pervision is available, they 
would be able to continue to 
enjoy working with comput- 
ers at the same time that 
they are experiencing them 
as a tool with a purpose be- 
yond the realm of hacking." 

, — Mitch Betts 
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9/4/87 Chicago, Illinois CG 196B-3287 


— i executi eral 
Search warrant. and had 
already been interviewed. een to out the 


search warrant and had observed the Bctivity taking place in his 
bedroom and the adjoining computer room, he agreed to be 
interviewed. By mutual agreement, this interview was conducted 
mu living room, which is located at the front of the house. 


was advised that no charges had been filed against him, that 
е was not under arrest and that the interviewing Agents had no 
intent to arrest him. indicated that he knew the reason 
Agents were in his home. 


[  ]was specifically asked if he had been "hacking". 
ENT "Yeah, what do you want to know?" 


mur that he got into a company computer a long 
time ago, but it was just a small computer. He advised that 
computers are hooked up so that they can call each other. He 
started on UNIX systems some time ago and eventually got into the 
AT&T system. Information th learned about one system helped 
him get into other systems. described this as a "chain 
reaction". 


has called a lot of different numbers, possibly 
between 5 and 600, all around the country. For the most part, 
he has not called numbers which have been publicized on computer 
bulletin boards. He has not used publicized numbers because that 
would run the "risk of something like this". 


Originally, his only interest in getting into other 
computers was for the sake of exploring. later, he wanted to 
learn the languages on these other machines. 


ШШШ. asked if he used any aliases when he was 
hacking. @ indicated that he did. He was therefore asked what 
names he us lied that the only name he_has been using 
recently is whic ound 
Previously ne has used or simply 
was specifi а i eard of a hacker who 
used the name indicated that he had no 
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was asked if he had called the BELL LABORATORY at 
Indian Hill. said that he had. i-e asked if he had 
managed Е о а computer known as eplied that 


he knows but that he never got_into it. е Wa efore 
asked if he ver masqueraded as Suiting, [.— [zeptied 
"Um, hmm" ed that with AT&T UNIX machines he did 
masquer He added that a Stem at Indian 
Hill is e model number is volunteered 
that he ined access to а lot of other computers. When 


asked how many, he replied that they were "innumerable". 

said that on his computer he did have a list of some of the other 
AT&T computers he had entered. WE that he has used a 
data network which links AT&T computers. With it, he has hopped 
around all over. 


He was asked if he had ever gained access to AT&T 
computers in New Jersey. He replied that he had, a couple of 
times. He was also asked if he had gained entry to AT&T 
computers in North Carolina. He replied that he did not 
specifically recall getting on a computer there. He observed 
that he has a friend Last Nam own (LNU), who lives in 
North Carolina. ever net in person. It is 
possible that was on a computer in another state and did not 
realize it. opserved, however, that he generally knew at 
least the state in which a computer was located. 


~. asked if he had ever gained access to the VAX 

em at „ He replied that he had on a couple of occasions. 

E observed that it was easy to get on that computer.  When.he' 
ialed the number he discovered that the previous user of a non- 

privileged account had not disconnected properly. Asa 

he was in the computer as soon as he dialed the number. ү 

get out software from that computer. 


ГА 


аја 


[ ___ statea that when he got into these computers, he 
wanted to look at the way AT&T programmed the computers. He 
wanted to see how programming was done professionally. As far as 
he Knows 228 faia not obtain any national defense secrets. Тһе 
information ne removed is scattered through his computer. He 
keeps information on his bard drive, not on floppy disks. 


As far as he knows] 1419 not get on a computer at 
an.Air Force base and did not obtain information about AUTOVON, 
the military communication network. He stated that he almost got 
on ARPANET, which he described as a defense data network. He 
believes that system may be connected to the VAX computer at MIT. 


vas asked if he had ever taken an artificial 
intelligence program from an AT&T computer. He replied that as 
far as he knows id not. He did get from one AT&T computer a 
program name which had to do with visual screen 
activities. He said that he got other pr from AT&T 
including EMACS, KORN SHELL, and E SHELL. | Jobservea that E 
SHELL was not very important. 
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— then asked what he did with all of this 
material. е replied that he kept it to himself pretty much. He 
said that he never sold any of these s. He used these 
programs only for his own education. ево stated that ће 

i ot let anybody copy the programs which he had obtained. 
[notes that three of his friends do have telephonic access to 

is computer because he has given them the proper password. As 
far as he knows, these friends have not taken any of the software 
he obtained. With the materials he obtained, jx 
learning some things like programming in "C". tated that 
he has not completely mastered programming in "C". 


was asked if he had ever been able to get into the 
AT&T program called COSMOS. He replied that he had not. 


was next asked if he had ever used unauthorized 
access codes to obtain long distance telephone services for free. 
He replied that several times he has used codes from numerous 
long distance services to avoid long distance charges. He has 
for example used an access number for ALLNET. He does not have 
an ALLNET accor got the access number from a computer 
bulletin board. lso used an access number to get 
service from SP ` observed that it is better to use 
access numbers for long distance service that have been listed on 
public computer bulletin boards. Such numbers are used by many 
people, so it is virtually impossible to be prosecuted. The real 
risk of prosecution would arise if you were to hack out such an 
access number by yourself. Since you would be the only person 


using that numb it would be easier to identify you and to 
prosecute you. knows that it is illegal to use such access 
numbers. 


mmu also asked about his knowledge of the 
regarding the software he obtained from AT&T computers. 
replied that he has noticed the copyright statements which appear 
in the AT&T computers. He knows that it is illegal to copy those 
programs but he added that he has not distributed those programs. 
He did not post the information he got on computer bulletin 
boards. He observed that the first time he got in trouble, the 
problem resulted from the fact that he did post information. 


The first time he got in trouble was when he broke into 
computers belonging to the KELLER BUSINESS SCHOOL and to a 
brokerage company whose name he no longer recalls. Both used an 
RSTS system. He did not do anything to the computers while he 
was in them and he did not do anything with the information he 
obtained. He did, however, post information on a bulletin board. 
Someone else called up those computers and shut them off. Asa 
result, the CHICAGO POLICE DEPARTMENT came to his home. This 
happened when he was 15 or 16 years old. 


шш not have to go to court as a result of that 
е was told that the offense was less than a 


incident. : | а . 
misdemeanor. At the time, he offered his services in explaining 
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to representatives of KELLER how he had gained access to the 


computer. His offer was not accep cause it became obvious 
to them how he had gained access. explained that he had 
used a "default password". He state at computer manufacturers 


place passwords in the system before the computer is delivered to 
a user. Unless a user like KELLER removes those passwords, 
anyone can gain access to the computer by using one of those 
passwords. 


Г] identified | | (ав another computer hacker 
in 


g into the KELLE er. 


is not familiar with UNIX. 


NN. he did not think anything would cone 
of the "А stuff" believed this because he tried not to 
leave any record of his entry into the computer. He said he 
tried to cover his tracks as best as he could. He believed that 
the best chance he would have of being caught would come from an 
examination of long distance telephone or local telephone 
records. He noted that he was implicated in the KELLER incident 
on the basis of local telephone records. 


Em. next asked if he had ever engaged in the use 
of "Trojan Horses". He replied that he had not made any trojan 
horses апа had not left any behind in the computers he had 
entered. 


was next asked why he had made calls to Pipe 
Creek, Texas. He replied that he had hacked into a guy's system 
there. Тһе guy was friendly about it and let continue to 
enter the syste is guy had access to a free message system 
called USENET. observed that a lot of it was run by AT&T. 


was next asked if he was a member of the Phreak 
Class 2600 computer bulletin board. replied that yes, that 
was one of the bulletin boards he used. He added, however, that 
he hag mot galieg that bulletin board for about 1 month. At this 


oint, as again confronted with his knowledge е, 
When confronted with the possibility that he, i as 
admitted that-he was [assured the Agents 
only subject matter he had lied about during 


the course of the interview. 


[| was asked if he realized that he could have caused 
significant problems to the communications network while he was 
exploring AT&T computers. [е ерте that he did realize he 
could have caused some problems, but as far as he knows, he did 
not. again stated that all he really wanted to do was to 
learn. е has been told that AUTOVON is a separate system from 
the one which you can dial up. He has not knowingly ever been on 
the AUTOVON system. As far as he knows, he has not obtained 
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а ows that lives 
каган — їп Chicago. did not partici 
with | Etre ғсак-іпс on AT&T computers. As far as 
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would need inside information in order to п COSMOS. 
Accordingly, he has not really tried to get in on the COSMOS 
system. Another reason he did not try to get into COSMOS was the 
fact that it was supposedly used only to keep track of 
maintenance records for the telephone company. 


information about AUTOVON or about NATO. NL — that one 


The only information distributed was that which 
was already public. state at he has a UNIX 3B1 computer 
which was bought at fest. 

At this point in the interview, was as 
examine copies of two messages which had been left by 
on bulletin boards. ‘After_ ing the message dated May 10, 
stated "I did post that". placed his initials before and 
after that message to identify thé portion he recognized. The 
second message was contained on two pages. recogni it as 
a nessage he had posted on the RIPCO bullet Mmm 
initialed the beginning and end of this message to identify it. 


ШИШЕ that he would not post anything valuable 
he had learned by hacking on one of the computer bulletin boards. 
It would not make any sense to post valuable information on a 
bulletin board because it would die too fast. It would be used 
just like the s numbers for long distance service. 
Generally, i¢[ — uas going to пу information he would do 
it on the RI ulletin board. asserted that he never 
wanted to cause any damage to a computer or to use a system 
against people. In his mind, he "just touring systems". At 
the conclusion of this interview, меле to his room in order 
to offer assistance to Agents and to representatives of AT&T who 
were still examining his computer. 


The following description was obtained by observation 
and interview: : 


Name 
Sex 
Race 
Date of birth 
Place of birth 
Height 
Weight 
Eyes 
Hair 
Hair style 
Scars, marks or 
tattoos 


did not remember his Social Security Account 
Number. He has an Illinois driver's license but he had to 
surrender that recently when he had an accident. 
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On 1/23/89, Judge Paul E. Plunkett 
for the Northern District of Illinois, found 
on five of the six counts of violation of Ti 7 9. ; 


Section 1030, Fraud and Related Activity in Conn with 
Conputers. On 2/14/89, Judge Plunkett sentenced to nine 
months i i period of probatio nd on 
8/6/91, In addition to this sentence and 
probation, was also ordered, within his ability, to pay 
$10,000 in tution. 


The underlying criminal tion charged that 
between 7/87 and 9/87, 18-year-old unlawfully entered 
computers owned and operated by AT&T and the U.S. Government, and 
illegally copied proprietary AT&T software valued in excess of 
$1.2 million, causing $174,000 worth of damage to AT&T computers. 
During the course of the one-week bench trial in 1/89, the 
Government's evidence also established that in 5/87 and 6/87, the 
defendant published passwords to AT&T computers on computer 
bulletin boards in Chicago and Texas. 


On 9/4/87, a search warrant was executed on 
residence at which time his computer was recovered alor 52 
of the AT&T copyrighted software programs which had been stolen 


from Bell Laboratory and North Atlantic Treaty Organization 
computers. 


| The case was prosecuted by Assistant U.S. Attorney 
William 2. Cook, and was the first trial ever brought under the 
Computer Fraud and Abuse Act of 1986. 
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